<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.5: http://docutils.sourceforge.net/" />
<title>Mid-term Report on PHoneyC GSoC project 1</title>
<meta name="author" content="Zhijie Chen (Joyan) &lt;czj.pub&#64;gmail.com&gt;" />
<style type="text/css">

/*
:Author: David Goodger (goodger@python.org)
:Id: $Id: html4css1.css 5196 2007-06-03 20:25:28Z wiemann $
:Copyright: This stylesheet has been placed in the public domain.

Default cascading style sheet for the HTML output of Docutils.

See http://docutils.sf.net/docs/howto/html-stylesheets.html for how to
customize this style sheet.
*/

/* used to remove borders from tables and images */
.borderless, table.borderless td, table.borderless th {
  border: 0 }

table.borderless td, table.borderless th {
  /* Override padding for "table.docutils td" with "! important".
     The right padding separates the table cells. */
  padding: 0 0.5em 0 0 ! important }

.first {
  /* Override more specific margin styles with "! important". */
  margin-top: 0 ! important }

.last, .with-subtitle {
  margin-bottom: 0 ! important }

.hidden {
  display: none }

a.toc-backref {
  text-decoration: none ;
  color: black }

blockquote.epigraph {
  margin: 2em 5em ; }

dl.docutils dd {
  margin-bottom: 0.5em }

/* Uncomment (and remove this text!) to get bold-faced definition list terms
dl.docutils dt {
  font-weight: bold }
*/

div.abstract {
  margin: 2em 5em }

div.abstract p.topic-title {
  font-weight: bold ;
  text-align: center }

div.admonition, div.attention, div.caution, div.danger, div.error,
div.hint, div.important, div.note, div.tip, div.warning {
  margin: 2em ;
  border: medium outset ;
  padding: 1em }

div.admonition p.admonition-title, div.hint p.admonition-title,
div.important p.admonition-title, div.note p.admonition-title,
div.tip p.admonition-title {
  font-weight: bold ;
  font-family: sans-serif }

div.attention p.admonition-title, div.caution p.admonition-title,
div.danger p.admonition-title, div.error p.admonition-title,
div.warning p.admonition-title {
  color: red ;
  font-weight: bold ;
  font-family: sans-serif }

/* Uncomment (and remove this text!) to get reduced vertical space in
   compound paragraphs.
div.compound .compound-first, div.compound .compound-middle {
  margin-bottom: 0.5em }

div.compound .compound-last, div.compound .compound-middle {
  margin-top: 0.5em }
*/

div.dedication {
  margin: 2em 5em ;
  text-align: center ;
  font-style: italic }

div.dedication p.topic-title {
  font-weight: bold ;
  font-style: normal }

div.figure {
  margin-left: 2em ;
  margin-right: 2em }

div.footer, div.header {
  clear: both;
  font-size: smaller }

div.line-block {
  display: block ;
  margin-top: 1em ;
  margin-bottom: 1em }

div.line-block div.line-block {
  margin-top: 0 ;
  margin-bottom: 0 ;
  margin-left: 1.5em }

div.sidebar {
  margin: 0 0 0.5em 1em ;
  border: medium outset ;
  padding: 1em ;
  background-color: #ffffee ;
  width: 40% ;
  float: right ;
  clear: right }

div.sidebar p.rubric {
  font-family: sans-serif ;
  font-size: medium }

div.system-messages {
  margin: 5em }

div.system-messages h1 {
  color: red }

div.system-message {
  border: medium outset ;
  padding: 1em }

div.system-message p.system-message-title {
  color: red ;
  font-weight: bold }

div.topic {
  margin: 2em }

h1.section-subtitle, h2.section-subtitle, h3.section-subtitle,
h4.section-subtitle, h5.section-subtitle, h6.section-subtitle {
  margin-top: 0.4em }

h1.title {
  text-align: center }

h2.subtitle {
  text-align: center }

hr.docutils {
  width: 75% }

img.align-left {
  clear: left }

img.align-right {
  clear: right }

ol.simple, ul.simple {
  margin-bottom: 1em }

ol.arabic {
  list-style: decimal }

ol.loweralpha {
  list-style: lower-alpha }

ol.upperalpha {
  list-style: upper-alpha }

ol.lowerroman {
  list-style: lower-roman }

ol.upperroman {
  list-style: upper-roman }

p.attribution {
  text-align: right ;
  margin-left: 50% }

p.caption {
  font-style: italic }

p.credits {
  font-style: italic ;
  font-size: smaller }

p.label {
  white-space: nowrap }

p.rubric {
  font-weight: bold ;
  font-size: larger ;
  color: maroon ;
  text-align: center }

p.sidebar-title {
  font-family: sans-serif ;
  font-weight: bold ;
  font-size: larger }

p.sidebar-subtitle {
  font-family: sans-serif ;
  font-weight: bold }

p.topic-title {
  font-weight: bold }

pre.address {
  margin-bottom: 0 ;
  margin-top: 0 ;
  font-family: serif ;
  font-size: 100% }

pre.literal-block, pre.doctest-block {
  margin-left: 2em ;
  margin-right: 2em }

span.classifier {
  font-family: sans-serif ;
  font-style: oblique }

span.classifier-delimiter {
  font-family: sans-serif ;
  font-weight: bold }

span.interpreted {
  font-family: sans-serif }

span.option {
  white-space: nowrap }

span.pre {
  white-space: pre }

span.problematic {
  color: red }

span.section-subtitle {
  /* font-size relative to parent (h1..h6 element) */
  font-size: 80% }

table.citation {
  border-left: solid 1px gray;
  margin-left: 1px }

table.docinfo {
  margin: 2em 4em }

table.docutils {
  margin-top: 0.5em ;
  margin-bottom: 0.5em }

table.footnote {
  border-left: solid 1px black;
  margin-left: 1px }

table.docutils td, table.docutils th,
table.docinfo td, table.docinfo th {
  padding-left: 0.5em ;
  padding-right: 0.5em ;
  vertical-align: top }

table.docutils th.field-name, table.docinfo th.docinfo-name {
  font-weight: bold ;
  text-align: left ;
  white-space: nowrap ;
  padding-left: 0 }

h1 tt.docutils, h2 tt.docutils, h3 tt.docutils,
h4 tt.docutils, h5 tt.docutils, h6 tt.docutils {
  font-size: 100% }

ul.auto-toc {
  list-style-type: none }

</style>
</head>
<body>
<div class="document" id="mid-term-report-on-phoneyc-gsoc-project-1">
<h1 class="title">Mid-term Report on <a class="reference external" href="http://code.google.com/p/phoneyc/">PHoneyC</a> GSoC project 1</h1>
<table class="docinfo" frame="void" rules="none">
<col class="docinfo-name" />
<col class="docinfo-content" />
<tbody valign="top">
<tr class="field"><th class="docinfo-name">Info:</th><td class="field-body">See &lt;<a class="reference external" href="https://www.honeynet.org/gsoc/project1">https://www.honeynet.org/gsoc/project1</a>&gt; for
project details.</td>
</tr>
<tr><th class="docinfo-name">Author:</th>
<td>Zhijie Chen (Joyan) &lt;<a class="reference external" href="mailto:czj.pub&#64;gmail.com">czj.pub&#64;gmail.com</a>&gt;</td></tr>
<tr class="field"><th class="docinfo-name">Mentor:</th><td class="field-body">Jose Nazario</td>
</tr>
<tr class="field"><th class="docinfo-name" colspan="2">Acknowledgments:</th></tr>
<tr><td>&nbsp;</td><td class="field-body">Jose Nazario, Jianwei Zhuge, Georg Wicherski, The
Honeynet Chinese Chapter</td>
</tr>
<tr class="field"><th class="docinfo-name">Description:</th><td class="field-body">Mid-term Report on <a class="reference external" href="http://code.google.com/p/phoneyc/">PHoneyC</a> GSoC project 1. This report
describes what I have done on the PHoneyC's libemu integration
for shellcode and heapspray detection during the first half of
the GSoC. Till now, the main ideas on this feature has been
fast-implemented (actually I mean poor coding style) and the
whole flow works well, with some code rewriting and performance
optimization needed in the future.</td>
</tr>
</tbody>
</table>
<div class="section" id="introduction">
<h1>Introduction</h1>
<p>PHoneyC is a low-interaction honeyclient written by Jose Nazario. The
shellcode (SC for short) and heapspray (HS for short) detection module
for PHoneyC is listed on the GSoC this year and I feel lucky to be
chosen to implement it. This report is the main idea about how to
detect SC/HS in PHoneyC and how to build and run this version of
PHoneyC. Note that this module (I call it honeyjs) is far from
complete currently and this report is only for midterm evaluation. So
it is possible that the way to build and run it won't work in the
future.</p>
<p>As for the introduction to PHoneyC, I think I'd better quote what the
original developer said in his paper 'PhoneyC: A Virtual client
Honeypot':</p>
<blockquote>
This paper presents PhoneyC, a honeyclient tool that can
provide visibility into new and complex client-side attacks.
PhoneyC is a virtual honeyclient, meaning it is not a real
application but rather an emulated client. By using dynamic
analysis, PhoneyC is able to remove the obfuscation from many
malicious pages. Furthermore, PhoneyC emulates specific
vulnerabilities to pinpoint the attack vector. PhoneyC is a
modular framework that enables the study of malicious HTTP
pages and understands modern vulnerabilities and attacker
techniques.</blockquote>
</div>
<div class="section" id="my-approach">
<h1>My Approach</h1>
<p>My approach to detection shellcode and heapspray can be simply
described as:</p>
<blockquote>
<p>1. Firstly I have modified the python-spidermonkey v0.0.1a
(written in Pyrex) to let the Javascript Virtual Machine
interrupted on each assignment.</p>
<p>2. Then I check if the r-value of this assignment is a string.
If so, I use libemu to check for shellcodes in this string. If
there are shellcode within the string, it will append an alert
message into the alert list.</p>
<p>3. A series of shellcode alerts relating to one variable will
be summarized into a potential heapspray alert.</p>
<p>4. After the execution of the Javascripts, phoneyc will
analyze the shellcodes for mal-download URLs and other
information using libemu.</p>
</blockquote>
<p>Also there are some optimizations such as mal-value hash table to
avoid duplicate check to the same value and dataflow tracking (e.g.
the concatenation of a mal-string (string that contains shellcodes)
with any other string will result in a mal-string).</p>
<p>The above is all I have done in the first half of this GSoC, and the
python module I implemented is named <strong>honeyjs</strong>.</p>
</div>
<div class="section" id="how-to-install">
<h1>How to Install</h1>
<div class="section" id="requirements">
<h2>Requirements</h2>
<p>To successfully compile the honeyjs module, the following
software/library is required:</p>
<blockquote>
<p><strong>Pyrex</strong></p>
<blockquote>
&quot;Pyrex - a Language for Writing Python Extension Modules.&quot;
&lt;<a class="reference external" href="http://www.cosc.canterbury.ac.nz/greg.ewing/python/Pyrex/">http://www.cosc.canterbury.ac.nz/greg.ewing/python/Pyrex/</a>&gt;. I
use version 0.9.8.5.</blockquote>
<p><strong>Spidermonkey(libjs)</strong></p>
<blockquote>
&quot;SpiderMonkey is the code-name for the Mozilla's C
implementation of JavaScript.&quot;
&lt;<a class="reference external" href="http://www.mozilla.org/js/spidermonkey/">http://www.mozilla.org/js/spidermonkey/</a>&gt;. I use version 1.8.0
pre-release 1.</blockquote>
<p><strong>Libemu</strong></p>
<blockquote>
&quot;libemu is a small library written in c offering basic x86
emulation and shellcode detection using GetPC heuristics.&quot;
&lt;<a class="reference external" href="http://libemu.carnivore.it/">http://libemu.carnivore.it/</a>&gt;. I use the version from the CVS.</blockquote>
</blockquote>
</div>
<div class="section" id="configuration">
<h2>Configuration</h2>
<p>For the reason that I will rewrite the pyrex code in C to use the
latest version of python-spidermonkey, it's meaningless to write any
automatic install scripts this moment. So you have to confirm the
packages above are correctly installed and manually change the path to
the libraries and header files in <em>./lib/setup,py</em> and run the command
<em>make</em> to build it.</p>
</div>
<div class="section" id="run-it">
<h2>Run it!</h2>
<p>To test this branch of PHoneyC, change the <strong>LINK</strong> variable in
<em>honeyclient.py</em> to your URL and run it. The shellcode/heapspray
alerts will be printed, the shellcode will be analyzed and the
URLs will be stored in a python list if it is a download-and-exec
shellcode.</p>
<p><em>NOTE</em>: The deobfuscating module is developed by another GSoCer so the
current deobfuscating ability is limited. We will merge together at
the end of the GSoC.</p>
<p>For example, running the honeyclient.py on the test sample 2448.html
will prints like this:</p>
<pre class="literal-block">
joyan&#64;JWork:~/code/phoneyc$ ./honeyclient.py
HONEYCLIENT MODULE TEST
fetching http://172.31.25.227/phoneyc/2448.html
[]
==&gt; http://172.31.25.227/phoneyc/2448.html
JS EVAL
Executing Javascript:
WARNING: I have to check such a long string! return -1 in developing mode
WARNING: I have to check such a long string! return -1 in developing mode
WARNING: I have to check such a long string! return -1 in developing mode
WARNING: I have to check such a long string! return -1 in developing mode
WebViewFolderIcon.setSlice attack
[ALERT] 0: 12150100 -&gt; Shellcode Detected HIT: 1
Runing shellcode... offset:5
DEBUG: Begin analyzing ...
DEBUG: SUCCESS offset = 0x00000005
DEBUG: emulating shellcode size 138stepcount 126652
UINT WINAPI WinExec (
     LPCSTR lpCmdLine = 0x00417085 =&gt;
           = &quot;calc&quot;;
     UINT uCmdShow = 0;
) =  32;
LPTOP_LEVEL_EXCEPTION_FILTER SetUnhandledExceptionFilter (
     LPTOP_LEVEL_EXCEPTION_FILTER lpTopLevelExceptionFilter = 0x00000000 =&gt;
         none;
) = 0x7c81cdda;
URLs:[]
Done
[ALERT] 0: 11611840 -&gt; Shellcode &amp; Potential heapspray sledge HIT: 100

VBS EVAL IFRAMES []
HREFS []
FRAMES []
IMAGES []


-----


HONEYCLIENT MODULE TEST - DONE
</pre>
</div>
</div>
<div class="section" id="what-to-do-in-the-future">
<h1>What to Do in the Future</h1>
<p>There are some known problems with the current implementation, which
includes:</p>
<blockquote>
<ol class="arabic simple">
<li>The 'strange' behavior of libemu's shellcode analyzing
function. Sometimes the shellcode can't be profiled thoroughly,
for example, the download-and-exec shellcode in
ssreader_0day.html sometimes can only finish the LoadLibrary
and GetprocAddress calls in the emulation, and won't go on to
invoke GetSystemDirectory and URLDownloadToFile APIs, as seen
from the shellcode profile.</li>
<li>It costs too much time to check a heapspray sledge for
shellcode. Some optimization is needed.</li>
</ol>
</blockquote>
<p>Things I will do next:</p>
<blockquote>
<ol class="arabic simple" start="3">
<li>Read the source code of the latest python-spidermonkey module
(v0.0.8).</li>
<li>Rewrite the whole honeyjs module in C. The current version of
honeyjs is based on python-spidermonkey v0.0.1a, which is
written in pyrex, but the latest version of python-spidermonkey
(v0.0.8) is written in C and has less bugs. And also another
PHoneyC GSoC project is also based on the latest version of
python-spidermonkey, so it's necessary for me to implement
honeyjs based on python-spidermonkey 0.0.8, too.</li>
<li>Write a more user-friendly install script for release.</li>
<li>Document the implementation.</li>
<li>Merge in Geng Wang's DOM simulation codes.</li>
<li>Try some new features, for example, hooking more APIs which
will be called in the shellcode.</li>
</ol>
</blockquote>
</div>
<div class="section" id="following-milestones">
<h1>Following Milestones</h1>
<dl class="docutils">
<dt><em>July 12</em>:</dt>
<dd>Finish Source Reading (Step 3).</dd>
<dt><em>July 26</em>:</dt>
<dd>Finish the rewriting stuff (Step 4).</dd>
<dt><em>August 2</em>:</dt>
<dd>Finish writing the install script and merging in Geng's DOM
simulation codes. (Step 5 and 7).</dd>
<dt><em>August 10</em></dt>
<dd>Finish documentation and tests.</dd>
</dl>
</div>
</div>
</body>
</html>
